LinuxCBT PackCapAnal Edition 2012

Introduction – Topology – Features

Discuss course outline
Explore system configuration
Identify key network interfaces to be used for captures
Identify connected interfaces on Cisco Switch
Explore network topology – IPv4 & IPv6
Identify Ethereal installation
Enumerate and discuss key Ethereal features

Ethereal® Graphical User Interface (GUI)

Identify installation footprint
Differentiate between promiscuous and non-promiscuous modes
Configure X.org to permit non-privileged user to write output to screen
Launch Ethereal GUI
Identify the primary GUI components /Packet List | Packet Details | Packet Bytes/
Discuss defaults
Explore key menu items

TCPDump | WinDump – Packet Capturing for /Linux|Unix|Windows/

Discuss defaults, features and applications
Use TCPDump on Linux to capture packets
Log traffic using default PCAP/TCPDump format
Discuss Berkeley Packet Filters (BPFs)
Capture and log specific packets using BPFs for analysis with Ethereal
Connect to Windows 2003 Server using Remote Desktop (RDesktop) utility
Install WinDump and WinPCAP on Windows 2003 Server
Identify available network interfaces using WinDump
Capture and log packets using WinDump
Capture and log specific packets using BPFs with WinDump for analysis with Ethereal
Upload captures to Linux system for analysis in Ethereal

Snort® NIDS Packet Capturing & Logging

Discuss Snort NIDS’s features
Confirm prerequisites – /PCRE|LibPCAP|GCC|Make/
Download and Import Snort G/PGP key and MD5SUM for Snort NIDS
Download, verify, compile and install Snort NIDS
Discuss BPF directional, type, and protocol qualifiers
Identify clear-text based network applications and define appropriate BPFs
Execute Snort NIDS in sniffer mode with BPFs enabled to match interesting traffic
Log to the active pseudo-terminal console and examine the packet flows
Combine BPF qualifiers to increase packet-matching capabilities
Use logical operators to define more flexible BPFs
Create captures for further analysis with Ethereal

Sun Snoop Packet Capturing & Logging

Connect to Solaris 10 system and prepare to use Snoop
Draw parallels to TCPDump
Enumerate key features
Sniff and log generic traffic
Sniff and log specific traffic using filters
Sniff using Snoop, HTTP and FTP traffic
Save filters for analysis by Ethereal
Snoop various Solaris interfaces for interesting traffic

Layer-2 & Internet Control Messaging Protocol (ICMP) Captures

Launch Ethereal
Identify sniffing interfaces
Capture Address Resolution Protocol (ARP) Packets using Capture Filters
Discuss and Identify Protocol Data Units (PDUs)
Identify default Ethereal capture file
Peruse packet capture statistics
Identify Cisco VOIP router generating ARP requests
Peruse time precision features – deci – nano-seconds
Discuss time manipulations – relative to first packet – actual time
Reveal protocol information from layer-1 through 7
Identify network broadcasts in the packet stream
Generate Layer-2 ARP traffic using PING and capture and analyze results
Sniff traffic based on MAC addresses using Ethereal and Capture FIlters

User Datagram Protocol (UDP) Captures & Analyses

Discuss UDP Characteristics
Focus on Network Time Protocol (NTP)
Setup NTP strata for testing between multiple systems
Analyze NTP – UDP traffic using Ethereal
Focus on Domain Name Service (DNS)
Install a BIND DNS Caching-Only Server
Analyze DIG queries
Analyze ‘nslookup’ queries
HomePage